Google says slap some GUAC on your software supply chain